Fix CVE for kube-dns pre k8s 1.6

[mikesplain]

Additional fix for #3512.

Testing now

[k8s-ci-robot]

Hi @mikesplain. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[mikesplain]

/assign @chrislovecnm

[mikesplain]

Tested spinning up a 1.5.7 cluster with this change and it's works well. I checked the rest of the containers in the pod and haven't found dnsmasq anywhere else.

[chrislovecnm]

We need someone to validate this. Can someone look at the 1.4 release and 1.5 release manifests in kubernetes/kubernetes?

[mikesplain]

Here's the 1.5 manifests for kube-dns included in the release.

kubernetes/kubernetes@f20b1fb

Looks like the identical change we had to make.

1.4 wasn't patched for this but their manifests are here, I believe:

https://github.com/kubernetes/kubernetes/blob/release-1.4/cluster/gce/coreos/kube-manifests/addons/dns/skydns-rc.yaml

[chrislovecnm]

@mikesplain where we on sky dns on 1.4?

[chrislovecnm]

So here is out 1.4 manifest in kops 1.5. https://github.com/kubernetes/kops/blob/release-1.5/upup/models/cloudup/resources/addons/kube-dns.addons.k8s.io/v1.4.0.yaml.template

We where not on sky-dns :) I think we are good, but would be really nice to get a straight answer. We have two options. Merge this now, and make sure we test k8s 1.4.x with alpha before release, or let this PR sit, and make sure that we test k8s 1.4.x with it.

[mikesplain]

@chrislovecnm Ahh yes, there it is. I should be able to spin up a 1.4 cluster today and give this a shot.

[chrislovecnm]

/ok-to-test

[mikesplain]

All set, tested a kops 1.7 cluster on 1.4.12 upgrading to kops 1.8 (and this change), no problems. Also tested a fresh kops 1.8 k8s 1.4.12 cluster.

[chrislovecnm]

@mikesplain tested on 1.4.

We will need release notes about the config map issue with the upgrade.

/lgtm

[k8s-github-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: chrislovecnm

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

• OWNERS [chrislovecnm]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

[k8s-github-robot]

/test all [submit-queue is verifying that this PR is safe to merge]

[k8s-github-robot]

Automatic merge from submit-queue.